블로그
리서치 보고서
Web3 보안 현황을 다루는 심층 보안 보고서, 사고 분석 및 산업 리서치.
보안 사고 분석Hedgey Finance Incident AnalysisOn 19 April 2024, Hedgey Finance was exploited for approximately $2 million on Ethereum in addition to a number of BONUS tokens on Arbitrum. The attacker took advantage of an oversight in the project’s ClaimCampaigns contract in which token approvals were not revoked, meaning anyone who used the createLockedCampaign() function could transfer tokens from the contract to themselves.
BNB Chain Q1 2024 Security ReportIn Q1 2024, BNB Chain witnessed a loss of $14,446,914 across 43 incidents, leading to an average loss of $335,974 per incident and a median loss of $151,476.
산업 리서치What is FinCEN and Why Does It Matter?The Financial Crimes Enforcement Network (FinCEN) is a bureau of the United States Department of the Treasury, established to guard against and investigate money laundering, terrorism financing, and other financial crimes. 
산업 리서치가상자산 TOP 3 컴플라이언스 리스크... 이에 대응하는 방법은?SkyInsights는 가상자산 컴플라이언스를 위한 최적화되고 효율적인 플랫폼입니다. 불법 온체인 활동, 제재 리스크, 그리고 복잡한 글로벌 가상자산 규제 등 주요 과제를 해결함으로써, 개발자들이 법적으로 안전한 운영 경로를 안정적으로 유지할 수 있도록 필요한 도구를 제공합니다.
보안 사고 분석Prisma Finance Incident AnalysisOn 28 March, Prisma Finance was exploited by multiple addresses leading to a loss of approximately $12.3 million. Three attackers took advantage of a vulnerability in the Prisma Finance MigrateTroveZap contract which allowed them to manipulate a migration process. Since the exploit occurred, a wallet that received funds from the main exploiter has reached out to the Prisma Finance deployer declaring that their actions were a white hat rescue. 
보안 사고 분석Risk On Blast Incident AnalysisOn 24 February, GambleFi project RiskOnBlast is thought to have become the first confirmed exit scam to occur on the Blast ecosystem, a layer-2 project on Ethereum.
보안 사고 분석Blast Chain's $97 Million Battle: Are North Korean Hackers Rusty?A detailed post-mortem analysis of the Munchables incident on the Blast mainnet, focusing on the methods used by attackers, the vulnerabilities exploited, and the subsequent community and project response to recover lost assets and enhance security measures.
산업 리서치March's Major Private Key Compromises
From 12 March to 16 March we have seen nine private key compromises (PKC) that have led to a combined loss of at least $22.96 million in March, with five of those incidents incurring losses over $1 million. These incidents showcase the continued devastation that private key leakages can have on the Web3 ecosystem which has already seen approximately $239 million lost to this type of attack in 2024.
보안 사고 분석The Vanishing Act: How Exit Scammers Mint New Tokens UndetectedIn this post, we detail a certain type of rug pull wherein scammers apparently create tokens out of thin air before dumping them on unsuspecting investors.
산업 리서치Stablecoin Regulations in Europe and Singapore: Single Fiat Currency Pegged StablecoinsThe last year has seen an unprecedented number of institutions turning their attention to onchain opportunities, and there are many financial organizations eager to offer a variety of Web3 products and services to these investors. However, an omnipresent hurdle is the lack of unified global regulation of crypto-assets.
보안 사고 분석OrdiZK Incident AnalysisOn the 5th March, CertiK confirmed OrdiZK orchestrated an exit scam that over a period of time stole approximately $1.4 million. In this incident the scammers used a verity of tactics to steal from investors including hoarding taxes from sales, dumping a large amount of tokens and abusing privileged roles to empty project contracts. This incident is the 6th exit scam of 2024 where losses have exceeded $1 million, contributing to the over $64 million lost to exit scams in 2024 so far. 
보안 사고 분석Crime Incorporated: CryptoGrab's UK Business RegistrationA cryptocurrency scamming group, CryptoGrab, has taken the bold step of registering as a private company in the UK. CryptoGrab offers various phishing services targeting cryptocurrency users, including the Nova Drainer and more traditional seed phrase phishing techniques. It is not uncommon for malicious actors to register fraudulent entities in the UK due to the relative ease in which companies can be registered. The group has stated in Telegram that this gives them access to platforms such as Binance and eToro. We have reported this organization to Action Fraud and Companies House in the UK. This blog aims to highlight the activities of this threat group and suggest ways to protect your assets.